Embedded App - how to decode and use the session token?

How does your application architecture look like? Do you work with a backend?